From: Eric Biggers Date: Tue, 14 Mar 2017 17:55:46 +0000 (-0700) Subject: common/config: don't hard-code SELinux context X-Git-Tag: v2022.05.01~2121 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=de88e28a1d3330760616bc8c08e269a18b3af869;p=users%2Fhch%2Fxfstests-dev.git common/config: don't hard-code SELinux context If SELinux is enabled, by default xfstests mounts its filesystems with "-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get created and interfere with tests. However, this particular context is not guaranteed to be available because the context names are a detail of the SELinux policy. The SELinux policy on Android systems, for example, does not have a context with this name. To fix this without having to manually override SELINUX_MOUNT_OPTIONS, just grab the SELinux context of the root directory. This is arbitrary, but it should always provide a valid context. And if for some reason someone is actually running xfstests in a specific SELinux context that needs files labeled with a particular context, then they may still override SELINUX_MOUNT_OPTIONS. Signed-off-by: Eric Biggers Reviewed-by: Eryu Guan Signed-off-by: Eryu Guan --- diff --git a/common/config b/common/config index 0c7335ad4..57c7dc3f6 100644 --- a/common/config +++ b/common/config @@ -260,10 +260,16 @@ case "$HOSTOS" in esac # SELinux adds extra xattrs which can mess up our expected output. -# So, mount with a context, and they won't be created -# # nfs_t is a "liberal" context so we can use it. +# So, mount with a context, and they won't be created. +# +# Since the context= option only accepts contexts defined in the SELinux +# policy, and different systems may have different policies with +# different context names, use the context of an existing directory. +# Assume that any valid context is fine, since xfstests should really +# only be run from an "unconfined" process, or with SELinux in permissive +# mode. But if not, just specify your own SELINUX_MOUNT_OPTIONS. if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then - : ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"} + : ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"} export SELINUX_MOUNT_OPTIONS fi